-

CVE-2026-89816

drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
non-blocking commits") fixed a very similar issue when the event was
allocated by drm_atomic_helper_setup_commit() itself.

However, if the event is allocated in prepare_signaling(), it will also be
set to NULL in complete_signaling(), which prevents drm_crtc_commit from
being put in __drm_atomic_helper_crtc_destroy_state().

Dropping the reference when the event is set to NULL at
complete_signaling() fixes the leak.

The leak can be reproduced by sending a signal to the thread using
DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
with amdgpu and vkms.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 24835e442f289813aa568d142a755672a740503c
Version < c5517b71101f61a45144e3cf77a19626355272de
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < 866a04137dac7e82a3848851061ff7ed15c2847e
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < 6a6a7aae4681a20cd32789fea9a487aaafa0e7a3
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < e2f27b5ed9084feb7bae9ef2bc80de37c92280b1
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < ff73f5f43d032c3da3c534c517f661e8dfeb358a
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < 66b1b309886337745d395bbc158440ab196305ce
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < e6195b941fdc8d81fc431c9f25539cf6c6234b51
Status affected
Version 24835e442f289813aa568d142a755672a740503c
Version < 4d4be202165e832d74849b4a68e289a2a377039c
Status affected
Version c75fe7899538890109aad7bbf92b2f304389e825
Status affected
Version 2a3241044b1c4ecc13f73b7158881881fb7534a1
Status affected
Version 4.9.19
Version < 4.10
Status affected
Version 4.10.7
Version < 4.11
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.11
Status affected
Version 0
Version < 4.11
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.116
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/c5517b71101f61a45144e3cf77a19626355272de
https://git.kernel.org/stable/c/866a04137dac7e82a3848851061ff7ed15c2847e
https://git.kernel.org/stable/c/6a6a7aae4681a20cd32789fea9a487aaafa0e7a3
https://git.kernel.org/stable/c/e2f27b5ed9084feb7bae9ef2bc80de37c92280b1
https://git.kernel.org/stable/c/ff73f5f43d032c3da3c534c517f661e8dfeb358a
https://git.kernel.org/stable/c/66b1b309886337745d395bbc158440ab196305ce
https://git.kernel.org/stable/c/e6195b941fdc8d81fc431c9f25539cf6c6234b51
https://git.kernel.org/stable/c/4d4be202165e832d74849b4a68e289a2a377039c